Trust no one: Thwarting "heartbleed" attacks using privacy-preserving computation

Nektarios Georgios Tsoutsos, Michail Maniatakos

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

A security bug in the OpenSSL library, codenamed Heartbleed, allowed attackers to read the contents of the corresponding server's memory, effectively revealing passwords, master keys, and users' session cookies. As long as the server memory contents are in the clear, it is a matter of time until the next bug/attack hands information over to attackers. In this paper, we investigate the applicability of privacy-preserving general-purpose computation, that would potentially render any information leaked indecipherable to attackers. Privacy is ensured by the use of homomorphically-encrypted memory contents. To this end, we explore the boundaries of general-purpose computation constrained for user data privacy. Specifically, we explore the minimum amount of information required for general purpose computation, which typically requires control flow and branches, and to what extent such information can be kept private from threats that have theoretically unlimited resources, including access to the internals of a target system.

Original languageEnglish (US)
Title of host publicationProceedings of IEEE Computer Society Annual Symposium on VLSI, ISVLSI
PublisherIEEE Computer Society
Pages59-64
Number of pages6
ISBN (Electronic)9781479937639
DOIs
StatePublished - Sep 18 2014
Event2014 IEEE Computer Society Annual Symposium on VLSI, ISVLSI 2014 - Tampa, United States
Duration: Jul 9 2014Jul 11 2014

Other

Other2014 IEEE Computer Society Annual Symposium on VLSI, ISVLSI 2014
CountryUnited States
CityTampa
Period7/9/147/11/14

Keywords

  • Heartbleed
  • OpenSSL
  • encrypted processor
  • homomorphic encryption
  • privacy-preserving computation

ASJC Scopus subject areas

  • Hardware and Architecture
  • Control and Systems Engineering
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Trust no one: Thwarting "heartbleed" attacks using privacy-preserving computation'. Together they form a unique fingerprint.

Cite this